THE CONSENT BURDEN IN CONSUMER AND DIGITAL MARKETS.

• Author: Corren, Ella

TABLE OF CONTENTS I. INTRODUCTION 553 II. DEFINING THE CONSENT BURDEN 561 A. Variations of Consent as a Control Strategy in Markets 562 B. Setting the Stage: Variations of Consent in Digital Markets 564 C. Ex Ante Burdens: The Burdens of Consenting 568 1. Informational Ex Ante Burdens 568 2. Decisional Ex Ante Burdens 576 D. Ex Post Burdens: The Burdens of Having Consented 580 1. Exogenous Ex Post Burdens 580 a. The Multi-Strategic Nature of the Ex Post Consent Burden 582 b. How the Consent Sword Is Wielded by Firms in Court 584 2. Endogenous Ex Post Burdens 586 III. HOW IS THE CONSENT BURDEN AFFECTED BY REGULATION? 587 A. An Inverse Relationship Between the Consent Burden and Regulation 588 B. An Exception to the Rule: Command-and-Consent Regulation 592 IV. ACCOUNTING FOR THE CONSENT BURDEN WILL CHANGE REGULATORY LOGIC 600 A. Analogizing the Consent Burden to the Regulatory Burden 602 B. Consent Burden Review: Fundamental Questions for Regulators 606 V. CONCLUSION 612 I. INTRODUCTION

Consent is a uniquely important mechanism. Some have even likened it to "magic." (1) In numerous legal, social, and moral settings, a simple "I agree" seamlessly transforms prohibited behavior into permitted, regulated behavior. (2) The widespread adoption of consent as a means to justify choices and conduct (3) reflects the adoption of individualism, autonomy, agency, and liberty as controlling values across countless regimes and circumstances. Consent is needed for innumerable everyday interactions and transactions, and its importance is also evident from extensive moral philosophy, law, ethics, and medical literatures about its meaning and validity. (4)

This Article focuses on the role of consent in consumer markets. Traditional law-and-economics approaches hold consent, operating as private ordering through vehicles such as contract or property, to be an efficient and desirable means of control over markets. A consent regime is expected to discipline firms through consumers' ability to switch, exit, and replace a supplier or a good by the mere redirection of their power to consent. It therefore enables market competition and represents a bottom-up governance solution via private rights, presumed to internalize incentives and minimize governance costs. (5) Consent is also simple to understand as a concept and easy to apply as a mechanism; we think we know it when we see it.

Because consent is a reaction to a set of facts, by adopting a consent regime we usually also adopt a requirement that firms disclose information and provide greater transparency to the public. The theory behind mechanisms of consent coupled with disclosure (disclosure-and-consent) is that if firms are required to provide information about their products and services on the basis of which individuals would give better-informed consent, then by little we achieve a lot and there is no need for extensive top-down government intervention (e.g., direct command-and-control regulation). (6) Consent therefore provides intervention without intervention, "self-regulation," and a leave-it-to-the-market type of solution. (7) By creating greater transparency, (8) disclosure-and-consent regimes are also assumed to promote accountability, procedural fairness, and other democratic values. (9)

Consent represents the ability of one to freely choose for oneself. In the market setting, this is premised on the assumption that collective ordering could be achieved through private rights and the rational choices individuals make. (10) These conceptions about consent generate its legal and moral legitimacy. Using consent to regulate behavior invites--indeed, assumes--autonomy and agency of individuals, values that are at the core philosophy of liberal democracies and their economies. (11)

This Article maps and then challenges the prominence of consent in consumer markets. The market-governing regimes of contracts, torts, and regulation are typically considered distinct. The Article's first contribution is therefore in observing and uncovering that consent is a pervasive principle in markets--a common thread among seemingly different legal regimes--and that consent in contracts, torts, and regulation has similar results for consumers. (12) In both contract law and tort law, consent has long played a part as a central policy lever. (13) But trends in consumer and digital markets have made consent even more ubiquitous; it no longer only operates in the realm of market-oriented private law. Consent has become a dominant part of public law and regulation. Regulators have been increasingly using consent as the control valve for various markets by choosing information-based regulatory schemes, with the logic that firms' disclosure of pertinent information about a product or service will facilitate consumer choice and informed consent. (14) As consent is a low-cost, low-intervention control mechanism, this type of regulation has become the go-to strategy for many regulators. (15) These regulation-created consent mechanisms range from ordinary disclosure law and "nudge" default mechanisms, which are based on various opt-out consent regimes, (16) to regulation that explicitly requires opt-in consent. (17) I call these consent-based regulations command-and-consent, as a deviation from the classic, direct, "command-and-control" model. (18) Whereas in command-and-control the regulator provides bright-line rules and limitations to determine what conduct is permitted or prohibited, in command-and-consent the heart of the control mechanism lies in the process of asking for and giving consent, and the conduct to which consent is being asked for is not closely limited, i.e., what the consumer agrees to determines what conduct is permitted.

Indeed, the range of markets to which consent is central is substantial and varied. They range from online, digital markets where one clicks "I agree" to privacy policies, terms and conditions, and software licenses to markets for physical products like cars that may come with fine-print terms and conditions and even privacy policies (19) to markets for medical and financial services and even to the rental market. (20) This variety includes both markets where the regulator has abstained from direct regulation, thereby relying on contractual or tort-based consent to discipline firms, and markets where regulators chose a command-and-consent regime, thereby utilizing consent as the control valve of an information-based regulatory scheme.

This Article focuses on digital markets and the information economy as a prime test case. (21) In digital markets, consent is especially dominant as a form of control regime and has become indispensable to the very structure and operation of the market. (22) The prevalent business model animating digital markets relies on a multi-sided structure: on the consumer-facing side a service or product is provided for a zero (23) or low cash price and the consumer is tracked and surveilled for their personal information, while on the business-facing side such personal information is monetized. (24) This market structure and the justification for the collection, use, and monetization of personal information are often based on consent. (25) Consumers are held to have consented to terms and conditions and privacy policies drafted by the firms that track, surveil, and profit from the use of personal information, profiling, and targeting. (26) As I explore below, consent is central to both American and European governance regimes in digital markets, (27) making consent not only a cornerstone of the digital business model but also a predominant governance tool. (28)

Given the pervasiveness of consent in consumer markets as well as its centrality in digital markets, the remaining question is whether consent works as intended. To answer this question, I introduce a new framework for analyzing consumer markets: the consent burden framework, which is this Article's second contribution. Part II develops the new consent burden framework. It defines the consent burden and explores how it unfolds in two temporal segments: ex ante and ex post burdens. Ex ante burdens are the informational and decision-making burdens imposed prior and leading to the moment of consenting. They stem from significant information asymmetries, combined with bounded rationality and limited attention spans. (29) Ex post burdens are the legal and rights-derogating burdens associated with the status of having consented. They stem from holding individuals accountable for their empty consent (30) to nonnegotiable contracts, consequently constraining their rights and remedies. This constraint is part exogenous, emanating from the law, and part endogenous, arising from internal mental commitments. (31) Part II illuminates why consent could be a failed governance solution based on the same criteria on which it is premised to be a good governance solution. The identification and explication of the consent burden provides a synthesis of diverse literatures and a theoretical foundation for understanding the tilted power balance that consent may create in markets.

In digital markets specifically, consent has proven inadequate for dealing with the individual and societal harms of the information economy and especially for realigning firms' systemically misaligned incentives. (32) In fact, rather than disciplining the darker side of the market where personal information is exploited, the use of consent facilitates it. (33) Similar to the law-and-economics account of consent more generally, (34) privacy law has typically regarded consent as a manifestation of autonomy and control over one's information. (35) Neither account of consent addresses or solves its core problem: empty consent continues to be the most prevalent form of consent in markets, (36) rendering consent a vehicle that legitimizes digital surveillance and other exploitations. While privacy theory and...